Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2196441/?format=api
{ "id": 2196441, "url": "http://patchwork.ozlabs.org/api/patches/2196441/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260213225323.5749-1-alan@sleuthco.ai/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260213225323.5749-1-alan@sleuthco.ai>", "list_archive_url": null, "date": "2026-02-13T22:53:23", "name": "main: refuse to run under file capabilities", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "1c86ec1c5a8492a8f4f3e201b7d5dc8d27766582", "submitter": { "id": 92640, "url": "http://patchwork.ozlabs.org/api/people/92640/?format=api", "name": "Alan Ross", "email": "alan@sleuthco.ai" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260213225323.5749-1-alan@sleuthco.ai/mbox/", "series": [ { "id": 492146, "url": "http://patchwork.ozlabs.org/api/series/492146/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=492146", "date": "2026-02-13T22:53:23", "name": "main: refuse to run under file capabilities", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/492146/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2196441/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2196441/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <netfilter-devel+bounces-10768-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=sleuthco.ai header.i=@sleuthco.ai header.a=rsa-sha256\n header.s=google header.b=c6peDAMQ;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=172.234.253.10; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-10768-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=sleuthco.ai header.i=@sleuthco.ai\n header.b=\"c6peDAMQ\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=209.85.222.176", "smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=sleuthco.ai", "smtp.subspace.kernel.org;\n spf=fail smtp.mailfrom=sleuthco.ai" ], "Received": [ "from sea.lore.kernel.org (sea.lore.kernel.org [172.234.253.10])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fCSBq2bSxz1xvS\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 14 Feb 2026 09:53:39 +1100 (AEDT)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id C0DBF303DA9D\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 13 Feb 2026 22:53:34 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 6990C3176EF;\n\tFri, 13 Feb 2026 22:53:34 +0000 (UTC)", "from mail-qk1-f176.google.com (mail-qk1-f176.google.com\n [209.85.222.176])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id C0FD92C11E5\n\tfor <netfilter-devel@vger.kernel.org>; Fri, 13 Feb 2026 22:53:32 +0000 (UTC)", "by mail-qk1-f176.google.com with SMTP id\n af79cd13be357-8cb48234b08so83106585a.1\n for <netfilter-devel@vger.kernel.org>;\n Fri, 13 Feb 2026 14:53:32 -0800 (PST)", "from localhost.localdomain\n ([2601:195:c200:c890:bc72:9727:601e:995e])\n by smtp.gmail.com with ESMTPSA id\n af79cd13be357-8cb4120f939sm277612585a.44.2026.02.13.14.53.30\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Fri, 13 Feb 2026 14:53:30 -0800 (PST)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1771023214; cv=none;\n b=YisbQY7ij55uWZHPELZO1+h6b8DVjtYmr57D36sHhwLct2picclZKHLpEILRQ5YTh7E8zMpDRDbzzz2BzVZscPKRUT4jx+i8OQ6ZGDwXkDMEeOehZ0BpPDfh8q2YLLWJMrMPF1esUa5oXeEk7WgFrM0nf0fTVWpCttwvooFT5I4=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1771023214; c=relaxed/simple;\n\tbh=5JMs9aIZ1bi3HLTDRgakvPbUT2rcR1gk4/WgD0hIJgI=;\n\th=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type;\n b=kj8pgwtUuT40HCEQVcU2y7+4opue+EBZF6+lMOJLaHRjDqjrNwfN+nj0S89deiDX/wefnxW3CybhHsjItvS7FD3MYxXKuBCdfLyj+SFjNcJqVW6OUdNG3FsP2A/+2yn9RIJlG2+FrG3MN4YGJFWOz0hLVy5uxoXy6JH5CQzwe6U=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=sleuthco.ai;\n spf=fail smtp.mailfrom=sleuthco.ai;\n dkim=pass (2048-bit key) header.d=sleuthco.ai header.i=@sleuthco.ai\n header.b=c6peDAMQ; arc=none smtp.client-ip=209.85.222.176", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=sleuthco.ai; s=google; t=1771023211; x=1771628011;\n darn=vger.kernel.org;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:from:to:cc:subject:date:message-id:reply-to;\n bh=kfqcDFPBwJDnv2FWvajh1p7LsMhJKi95glIjMj+Kkeg=;\n b=c6peDAMQPAa5dy/+X0y3QsYM1lCUbykRPH6FkCc911hYsG+n9kc91DwlXGOivn43y8\n ahL58RUR9MzKYf4R3N+bIN+xF1u2r2WCvaZvaLh8/5+yhgsgXYrdcmqwfvO4+ner4IIi\n MKO7shkCogFI2v5OoRlpADna7oKr/jPCfm81fp71+CXDw7Ex/s+j6NuKQl9sOFkIX8EM\n 7JV4Z2Kv3UTAqyGZsl0plEyF8zjd+QK76rdf9QpgUuojoz/da2rfyy8VOf4UdONi+i7f\n thbRxpg+Ib9nsywR6PkJ1XNc/KWU/Ni9UvUQYu1VP44aakXzXTTrDt8TsuqDwfoBk+VV\n mNSg==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20230601; t=1771023211; x=1771628011;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=kfqcDFPBwJDnv2FWvajh1p7LsMhJKi95glIjMj+Kkeg=;\n b=q9yhyZb0IetI/zlCxOjcxAvC+1um+EQoApdVaO7YCbfQW6fIf88MV9oGwou7g6xMg5\n EQRSr6LkBOjq+Ex06KiOpLwl6Wh/T/OApfRUB+UltcWVVWeiAHwO4H8yzSfAUtkPrsak\n HR+2JqrOWl6nAqQ3GcxulgdR4BXOElr+uPfYecnLkxC9LS/2OX+sXuwisVoU6agQ9wxL\n B+1s5uDEBv/MgGPQsf+a/uz3zmoMFaa1PkvHGafnJJcbN8AeY67YKJWrEdqYs/Fi3Jqp\n Sk8M7NXR3FScWC4dkAT2/6PO13Xf3VJYCV4layMWkvzs+aZGzi/eIf2oN/KLnR93vb1D\n YISg==", "X-Gm-Message-State": "AOJu0YyCJ3P5/GGPK8e4gpDoWk+OvyJqEz/ArxCMDPVMTCspVFoDjlOR\n\t/z5NIgZj+OsHovHFXT/ETmMbpF2j1afC8f0MVSIR+kijFGAF77huy06E1ygEUgzwydKkSgh8QAm\n\t1k72Ws2+r", "X-Gm-Gg": "AZuq6aJf24b+w9CKUGqoRs3xcjCpgmwS+drKpj307OIzfMlcdDUX283wl0VebjxykLG\n\tUYNOV303RgIrGrPLSr0mj1qc9kqbfLCMJS5/ZxrgkOtVu0ktnAsRc4zAT+OagLHDr8VPrD92hHR\n\t/Vb4mGBxgXkotrNMnGC945hDx1wiNiiPYfb2tz1hplRfX4NGNfvMZDerlTgxQBaW/QASsFC1Mqt\n\tuUmpswR3G2FHjQK9ciofFF2yMgmCUo+1eAX5Pd5r1nrL9ewND4H6y23B1pjtpM693tXYNLdBpx1\n\th6ePDU/Dc0E1IbhSuafbaCfovWKUAMILKx1jF+m5/5oEz/k8d4jLN046X80jsulUXUmzRXE57P5\n\tedWtNh6xv0DbLZa6vxkVewop6kVclulEhM4XBJC7q2uHC3lKnDynPTHsnExXKnWXRvCVA3mcbwm\n\th40kZ/CIOWgskuARciarkB6gAk0DSbXtrXMR1Psnk=", "X-Received": "by 2002:a05:620a:1917:b0:85e:b7b6:81e2 with SMTP id\n af79cd13be357-8cb4c00c942mr138175685a.50.1771023211087;\n Fri, 13 Feb 2026 14:53:31 -0800 (PST)", "From": "Alan Ross <alan@sleuthco.ai>", "To": "netfilter-devel@vger.kernel.org", "Cc": "pablo@netfilter.org,\n\tAlan Ross <alan@sleuthco.ai>", "Subject": "[PATCH] main: refuse to run under file capabilities", "Date": "Fri, 13 Feb 2026 17:53:23 -0500", "Message-ID": "<20260213225323.5749-1-alan@sleuthco.ai>", "X-Mailer": "git-send-email 2.52.0.windows.1", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Type": "text/plain; charset=UTF-8", "Content-Transfer-Encoding": "8bit" }, "content": "Extend the existing setuid guard in main() to also detect\nfile capabilities via getauxval(AT_SECURE).\n\nSome container runtimes and minimal distributions grant cap_net_admin\nvia file capabilities (setcap cap_net_admin+ep /usr/sbin/nft)\nrather than running through sudo. In that configuration the kernel\nsets AT_SECURE and the dynamic linker strips LD_PRELOAD, but\ngetuid() == geteuid() so the existing setuid check passes.\n\nCAP_NET_ADMIN is quite powerful; even without dlopen(), we should not\nsanction setcap-installations — a control flow bug could still be\nexploited as the capability-elevated user.\n\ngetauxval(AT_SECURE) is nonzero whenever the kernel has set AT_SECURE\nin the auxiliary vector — this covers both classic setuid/setgid and\nfile capabilities. Exit with status 111, matching the existing\nsetuid behavior.\n\nSigned-off-by: Alan Ross <alan@sleuthco.ai>\n---\n src/main.c | 5 +++--\n 1 file changed, 3 insertions(+), 2 deletions(-)", "diff": "diff --git a/src/main.c b/src/main.c\nindex 29b0533..af49bec 100644\n--- a/src/main.c\n+++ b/src/main.c\n@@ -17,6 +17,7 @@\n #include <getopt.h>\n #include <fcntl.h>\n #include <sys/types.h>\n+#include <sys/auxv.h>\n \n #include <nftables/libnftables.h>\n #include <utils.h>\n@@ -371,8 +372,8 @@ int main(int argc, char * const *argv)\n \tchar *filename = NULL;\n \tunsigned int len;\n \n-\t/* nftables cannot be used with setuid in a safe way. */\n-\tif (getuid() != geteuid())\n+\t/* nftables cannot be used with setuid/setcap in a safe way. */\n+\tif (getuid() != geteuid() || getauxval(AT_SECURE))\n \t\t_exit(111);\n \n \tif (!nft_options_check(argc, argv))\n", "prefixes": [] }